AI agents now routinely run code they wrote or were told to run — and prompt injection means an attacker can choose that code. So the safe assumption is that every line the agent executes is hostile, and your job is containment. Here's the isolation spectrum from bare process to Firecracker microVM, why a Docker container is not a security boundary against hostile code, and how to build an ephemeral, egress-filtered sandbox that survives a successful injection.
Most teams use Redis for one thing and miss the four others. Rate limiting, distributed locks, idempotency, ephemeral session storage, and a serviceable job queue — each in a few commands, each replacing something heavier.
A modest app somehow grew Postgres, Redis, RabbitMQ, Elasticsearch and a vector DB — five things to back up, secure and pay for. Most of that is now one Postgres. Here's the queue, vector, search and pub/sub SQL, and the honest signals for when to graduate.